Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
193
87
18
17
15
Contributors
54
46
42
41
30
Categories
143
142
77
60
47
Platforms
238
82
37
36
22
Products / Services
66
51
49
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
2
2
2
1
IDS Classtypes
3
IDS Protocols
3
User All Event Log Activity
Cortex XDR
This rule monitors Windows event logs for activity involving the SAM account name, which may indicate account enumeration, credential access attempts, or malicious modifications to account security settings.
This rule identifies accounts (by SID) that have registered multiple local AI agent instances. It aggregates agent registration information over a 30-day period, summarizing the total count of agents and listing specific device names and IDs associated with each account to identify potential anomalous behavior, such as credential abuse or unauthorized mass deployment of local AI tools.
Detects instances where AI coding assistants (e.g., Cursor, Claude, Copilot) are observed interacting with specific configuration or sensitive files and subsequently initiating suspicious shell commands. The rule correlates file read activity (containing keywords like 'skill', 'preflight', '.ssh', or '.aws') followed closely by execution of potentially malicious commands like 'whoami /priv', credential decoding, or registry exploration, indicating potential abuse of the assistant's context.
This rule identifies accounts (by SID) that have registered multiple local AI agent instances. It aggregates agent registration information over a 30-day period, summarizing the total count of agents and listing specific device names and IDs associated with each account to identify potential anomalous behavior, such as credential abuse or unauthorized mass deployment of local AI tools.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
Detects network-based enumeration of Active Directory components, including user accounts, computer objects, group memberships, session information, and domain trust relationships. This pattern is characteristic of automated discovery tools used during the reconnaissance phase of an attack.
Detects SLURM job-queue enumeration (squeue/sinfo/scontrol) spawned specifically from a Python parent process, narrowing generic HPC admin commands to the mrmustard stealer's recon pattern.
Detects potential username enumeration attempts against Microsoft Entra ID (Azure AD) by monitoring for the 'AADSTS50034' error code, which occurs when a sign-in attempt is made with a username that does not exist in the directory. This behavior is often associated with adversary reconnaissance to identify valid user accounts.
This rule monitors the Microsoft 365 AuditLogs to retrieve and investigate all actions taken by or against a specific user account. It expands the TargetResources field to extract the TargetUPN and filters for a specific account, providing a timeline of operations, the actor who initiated the action, and the result of the operation.
Detects certain command line parameters often used during reconnaissance activity via web shells
Detects successful read operations of Azure role assignments where the response or properties involve the 'Contributor' role, potentially indicating reconnaissance of highly privileged access within the subscription.
Detects the execution of known offensive PowerShell scripts used for Active Directory information gathering, as identified by specific file names or internal script block strings.
Detects the execution of the SharpShares tool, which is commonly used by adversaries to enumerate network shares across a domain or local network for reconnaissance purposes.
Detects Commandlet names from well-known PowerShell exploitation frameworks
This rule monitors for processes dynamically resolving sensitive Windows networking API functions (WNetAddConnection2, NetShareEnum, NetUserEnum) at runtime using GetProcAddress. This technique is often used by malware to conceal its reliance on legitimate system APIs to perform discovery operations, such as enumerating network shares or users, while evading static analysis.
This rule detects high volumes of LDAP queries performed by a single user account from a specific device within a 10-minute window. A significant spike in LDAP query activity is often indicative of automated directory enumeration or reconnaissance, potentially aiming to map the environment, identify target users, or discover services.
Detects execution and file activity associated with Sysinternals AD Explorer, a tool often used by adversaries to enumerate Active Directory environments and perform snapshots.
Detects the use of the klist.exe utility with suspicious subcommands ('sessions', '-li', 'get', 'purge') to inspect, retrieve, or clear cached Kerberos tickets, which is indicative of credential discovery or post-exploitation activity.
This rule detects potentially malicious reconnaissance or enumeration activity by identifying a high volume of Microsoft Graph API requests (GET requests) to sensitive directory endpoints (users, groups, directoryRoles, servicePrincipals) from a single application identity (AppId) and IP address within a short time window.
Page 6 of 17